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Introduction 


On 15th December 2020, the European Commission presented a legislative package comprising two proposals 
for new Regulations - the Digital Services Act (DSA) and the Digital Markets Act (DMA) - setting out the legal 
framework in the EU for all digital developments over the next decade. The package was prepared by the 
services of the Executive Vice President for A Europe Fit for the Digital Age, Margrethe Vestager, and by the 
European Commissioner for Internal Market, Thierry Breton. 


The DSA, which amends the e-Commerce Directive (2000/31/EC) will govern the responsibilities of digital 
platforms. Following the example set by the General Data Protection Regulation (GDPR), it will also apply to 
platforms established outside the EU in case they target European consumers. More obligations are envisaged 
for platforms with at least 45 million users, namely with regard to cooperation with regulators, data access 
requirements for researchers and overall transparency. Companies that don’t comply with the legislation can 
face a fine of up to 6% of their annual global turnover. 


This document focuses on the first Regulation, the DSA. A separate document will later address the second 
Regulation, the DMA. 


Context and Background 


The expressed purpose of the Digital Services Act (DSA) is to update the European Union’s legal framework, in 
particular by modernising the e-Commerce Directive which dates back to 2000. Discussions on the review of 
the e-Commerce Directive started back in 2014. 


In reality, DSA is a new piece of legislation encompassing provisions to address illegal content online (which 
has avery broad definition), transparent advertising requirements, disinformation, etc. 


In Summer 2020, a public consultation of the European Commission received over 2,800 responses and 
around 300 position papers from interested NGOs, companies/business associations, and individuals. 


Member States, businesses, associations and civil society might have different priorities on the file, but one 
thing is clear - transparency of advertising and codes of conduct have a central role in the Regulation and EDAA 
is ideally positioned as ready to contribute to this debate with tools, expertise, and know-how. 
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What digital services does the DSA cover? 


The Digital Services Act (DSA) applies to online intermediaries, which include services such as Internet Service 
Providers, cloud services, messaging, marketplaces, or social networks. These digital services transmit or 
store content of third parties. Specific due diligence obligations apply to hosting services, and in particular 
to online platforms, a subcategory of hosting services. Examples of online platforms include social networks, 
content-sharing platforms, app stores, online marketplaces, online travel and accommodation platforms. A 
subset of rules specified in the DSA focus on very large online platforms, which have a significant societal and 
economic impact, reaching at least 45 million users in the EU (10% of the population). 


Will the new rules apply to companies outside of the EU? 


Yes, as the rules will apply in the EU’s Single Market, without discriminating on where a company is established. 
Online intermediaries established outside of the EU, which offer their services in the Single Market, will have 
to comply. A legal representative should be appointed for non-EU established companies, similar to the GDPR 
requirement. 


How does the DSA regulate online advertising? 


The Digital Services Act (DSA) proposal covers any type of advertising made available on online platforms, 
from digital marketing to issue-based advertising and political ads and complements existing rules such as the 
GDPR, which already establishes, for example, rules on users’ consent or their right to object to targeted digital 
marketing. 


The proposed rules in the DSA will empower users in gaining greater understanding and making informed 
decisions about the ads they see. They will have to be clearly informed whether and why they are targeted by 
each ad and who paid for the ad; they should also see very clearly when content is sponsored or organically 
posted on a platform. Furthermore, users will now be given the possibility to report potentially illegal ads to the 
platforms, as part of a broader Notice and Action mechanism already in place to tackle the presence of illegal 
activity or information on online platforms. For very large online platforms, the societal stakes are higher, and 
the rules include additional measures to mitigate risks and enable oversight. They will have to maintain and 
provide public access to ad repositories, allowing researchers, civil society and authorities to inspect how ads 
were displayed and how they were targeted. They will also need to assess whether and how their advertising 
systems are manipulated, and take measures to mitigate these risks. 


These new rules will be complemented by a second legislative proposal, the Digital Markets Act (DMA), which 
will impose increased transparency requirements on gatekeepers, such as information about the price of ads 
and the remuneration paid to the publisher. Gatekeepers will also need to provide access to their performance 
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measuring tools and the information necessary for advertisers and publishers to carry out their own 
independent verification of the ad inventory. 


By the end of the year, these measures will also be complemented by a forthcoming Regulation on political 
advertising, which will include rules on micro-targeting of political and issue-based campaign messages. 


Will DSA change the rules on privacy in advertising? 


No. The Digital Services Act (DSA) proposal is without prejudice to the GDPR (Regulation (EU) 2016/679), the 
e-Privacy Directive (Directive 2009/136/EC) and other Union rules on protection of personal data and privacy 
of communications. 


Existing rules on consent and the right to object to processing of personal data remain in place. The DSA will 
impose additional transparency obligations for online platforms, which will enable users to make better use 
of their rights as data subjects. The DSA will also enable scrutiny by authorities and access to information for 
vetted researchers on how advertisements are displayed and how they are targeted. 


What does the EDAA’s European Self-Regulatory Programme on 
Data-Driven Advertising do? 


The EDAA Programme aims to foster transparency in the online advertising environment for both users and 
companies. 


@ Participating companies must respect a set of European Industry Self-Regulatory Principles for Data 
Driven Advertising and undergo an independent audit every two years. 

@ The ‘AdChoices Icon’ is integrated on a vast majority of online behaviourally targeted ads in 
Europe, providing users with enhanced transparency via access to information for each specific 
advertisement displayed to each individual recipient. 

@ Users are offered options to learn more about and to tailor their online advertising experience. 
This is possible through the YourOnlineChoices platform (available in 33 European markets and 27 
languages). 

@ The same pan-European, cross-industry portal provides participating companies with self-regulatory 
solutions to offer users readily-available access to their privacy notices and user-friendly explanations 
of what they do. It provides users with accessible means to register queries or complaints directly 
to well-recognised national advertising self-regulatory organisations in their own country and in their 
local language. 

@ The programme promotes, on YourOnlineChoices.eu, a wealth of consumer-facing educational 
materials about digital advertising, on top of delivering specific online and offline education and 
awareness-raising initiatives across Europe. 
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Businesses participating in the programme are responsible for their legal compliance and do not rely on the 
programme for that purpose. However, many companies choose to adopt these self-regulatory tools as part of 
a broader ecology of statutory and self-regulatory solutions. 


Access here an infographic about the EDAA Self-Regulatory programme and tools. 


Users’ perspective 


“Ihave just seen an advertisement which seems to be targeted specifically 
at me. How can I know more about it?” 


1. Youcan click or tap on the AdChoices Icon, a small triangular symbol that appears on top of online 
and mobile ads. 


db 


BUY NOW 


2. There you will be able to: 
A. see who has delivered this ad to you, 


B. understand, from the company serving the ad, more about why this ad has been 
delivered to you specifically, and 


C. get access to a platform, available in all EU languages, where you can exercise 
choice with regard to targeted advertising based on your interests. 
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“I do not want to receive targeted advertising. Is there a way to stop this 
from happening?” 
Yes. In two ways: 


1. You can click on the AdChoices Icon and then make your way to the Consumer Choice Platform at 
www.youronlinechoices.eu, 


2. You can visit www.youronlinechoices.eu directly. 


e Your Online Choices 


AdChoices 
Gives You Contro. 


Upon accessing your country and language-specific section, you can learn more about how digital advertising 
works, what choices you have about it, and you can turn off advertising tailored to your interests. 


“How can! be sure that companies will respect my choice not to use my 
data for targeted advertising?” 


There’s an immediate confirmation of your choice on the youronlinechoices.eu platform, and you will be able to 
see that the status reported by the participating companies change. Companies participating in the European 
Self-Regulatory Programme administered by EDAA have to self-certify their compliance. In addition, they must 
go through an independent certification process that grants them with a Trust Seal - which confirms that they 
respect the choices that users have made. This process is subject to ongoing monitoring and the independent 
certification is renewed every two years. 


It is also important to know that you can place a query or formal complaint, should you feel that companies are 
not respecting your choice, with the EDAA directly or with the national advertising Self-Regulatory Organisation 
in some countries as our accountability partners. 
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“How can! benefit from transparency for each specific advertisement 
that | see as an individual recipient?” 


Online advertising is already subject to transparency requirements, laid out in different legislations - such as 
the GDPR, ePrivacy Directive and Unfair Commercial Practices Directive. Further requirements may come from 
additional self-regulatory programmes companies choose to be part of. 


The European Interactive Digital Advertising Alliance (EDAA) Self-Regulatory Programme for Data Driven 
Advertising offers real time enhanced transparency, for each specific advertisement displayed to each 
individual recipient, thanks to the consumer-facing, interactive symbol (the AdChoices Icon) which was 
delivered over 150 billion times in online ads across Europe in 2019 alone. This means that in most cases, 
users can - with only one click - have real-time information about the advertisement they are seeing. This user- 
friendly way means that they do not have to look extensively for general privacy policies or other centralised 
information. 


Since 2012, this transparency, choice, and control Programme has helped to generate consumer trust online, 
with between 29% and 60% of respondents in ten surveyed countries sharing that they have a higher level 
of trust in the overall transparency of the digital advertising ecosystem when the AdChoices Icon is present, 
the 2021 European Advertising Consumer Research Report conducted by IPSOS MORI on behalf of the EDAA 
shows. 


Industry perspective 


“How can the EDAA Self-Regulatory tools help companies provide 
transparency, choice and control to end-users?” 


Art. 24 of the Digital Services Act (DSA) requires that information be provided for each specific advertisement 
displayed to each individual recipient in a clear and unambiguous manner and in real time. With the AdChoices 
Icon, the EDAA programme provides real time transparency for each specific ad displayed to each individual 
user. In other words, when clicking on the Icon, users access precise information about the specific ad they are 
seeing at the very moment the ad is being displayed. 


The “real time” dimension provides precise information about each ad to the user at the very time when the ad 
is being displayed. The AdChoices Icon currently provides precisely this real-time functionality. 


>> EDAA Fact Sheet 


© 


EUROPEAN 
INTERACTIVE 
DIGITAL 
ADVERTISING 
ALLIANCE 


@ Oa 


Implemented in Europe since 2012, the AdChoices Icon is a well-recognised, ubiquitous symbol showing on 
top of targeted ads, providing a clear and unambiguous tool for users to access information about the ad they 
are seeing. The 2021 European Advertising Consumer Research Report conducted by IPSOS MORI on behalf 
of the EDAA shows that the recognition of the AdChoices Icon when accompanied by AdMarker, local language 
elements (such as “AdChoices”, “Choisir sa pub”, “Gestion anuncios”, “Datenschutzinfo” etc) is between 22% 
and 51% depending on country. 


When part of the EDAA programme, companies must disclose specific information related to the ads served to 
individuals. Many of these requirements echo the transparency requirements proposed in Art. 24 of the DSA: 


@ Thelcon helps users identify that the information displayed is an advertisement: 
This requirement is currently partially addressed in a number of European languages via the wording 
available next to the Icon, the AdMarker. For example, AdChoices, in English and the equivalent in 
other European languages, includes the wording “Ad” (e.g., French: Choisir Sa Pub, Spanish: Gestion 
anuncios, etc.). Companies in some jurisdictions use it already for that specific purpose, i.e., to mark 
advertisements as such. 


@ The Icon provides information on who is behind the ad: 

This provision requires that end-users are made aware of the identity of the advertiser. While some 
advertiser-related information exists with most, if not all, platforms and Demand-Side Platforms 
(DSPs), it is not currently being shown to the end user. 

Currently, the AdChoices Icon identifies the “displayer” - i.e. the adtech company that serves the ad. 
However, many companies also use the Icon to provide more transparency than the requirements of 
the Programme to users, showing the potential of the tool to make real time information available 
to users, such as information about the identity of the advertiser. In general, the Icon is a tool 
enabling the ad ecosystem to provide real time transparency to each user about the specific ad they 
are seeing. The EDAA self-regulatory programme provides for a set of transparency requirements. 
Nonetheless, even today, some major players use this tool to provide further information, such as 
information about why the ad has been shown to a particular user - i.e. the targeting criteria - or other 
types of information, demonstrating the value of the Icon to provide users with transparency. 


@ The Icon allows companies to disclose meaningful information about the main parameters used 
to determine the recipient to whom the advertisement is displayed. 
A number of players currently use the AdChoices Icon to disclose more specific information about 
the targeting criteria used to deliver any given ad to a particular user, demonstrating how some 
provisions of the DSA draft could be implemented. This corresponds to elements of the DSA draft 
which indicates that the targeting criteria for the specific ad should be available to users. 
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“What kind of industry standards are incentivised by the DSA and 
encouraged by the European Commission?” 


Art. 34 of the Digital Services Act (DSA) Regulation calls for the development of voluntary industry standards 
and relevant European [...] standardisation bodies, in particular for the transmission of data between 
advertising intermediaries in support of transparency obligations. EDAA stands out as such a relevant body, 
due to its expertise, experience, and the scope of the existing programme. 


In order to provide the real time transparency behind the AdChoices Icon, EDAA works with different industry 
bodies to ensure “transmission of data between advertising intermediaries”, in a similar manner to the 
proposed DSA text. 


“What impact will the proposed DSA have on advertising transparency on 
platforms and very large platforms?” 


All platforms, except the smallest, will be required to set up complaint and redress mechanisms and out-of- 
court dispute settlement mechanisms, cooperate with trusted flaggers, take measures against abusive 
notices, deal with complaints, vet the credentials of third party suppliers, and provide user-facing real time 
transparency of online advertising. 


The European Self-Regulatory Programme administered by EDAA is a concrete example of how real time 
online advertising transparency can be provided in a meaningful way, in alignment with DSA requirements. 
The Programme, via the AdChoices Icon is ideally positioned to help with the user-facing transparency 
requirements. Most of those requirements are either already implemented in the Programme or can be 
implemented with minor adjustments. EDAA implements a Trust Seal, awarded via a certification mechanism 
carried out by independent providers, attesting compliance with the Self-Regulatory rules and best practices, 
thus offering an opportunity for the ecosystem to meet future requirements of the DSA proposal, of vetting 
credentials of suppliers when it comes to digital advertising. 


In addition, very large online platforms, reaching 45 million users or more (i.e. representing 10% of the 
European population) are subject to specific rules due to the particular risks they pose in the dissemination of 
illegal content and societal harms. Very large online platforms will have to meet risk management obligations, 
external risk auditing and public accountability, provide transparency of their recommender systems and user 
choice for access to information, as well as share data with authorities and researchers. 
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“What penalties will businesses face if they do not comply with the new 
rules?” 


The new enforcement mechanism follows a similar concept to the GDPR, with national and EU-level 
cooperation. Each Member State will appoint a Digital Services Coordinator (DSC), an independent authority 
which will be responsible for supervising the intermediary services established in that Member State. The DSC 
will supervise how online intermediaries adapt their systems to the new requirements and will have the power 
to impose penalties (decided by the Member State), including financial fines. 


For the case of very large platforms, the European Commission will have direct supervision powers and can, in 
the most serious cases, impose fines of up to 6% of the annual global turnover of a service provider. 


The Digital Services Coordinator and the Commission will have the power to require immediate actions where 
necessary to address very serious harms, and platforms may offer commitments on how they will remedy 
them. For rogue platforms refusing to comply with important obligations and thereby endangering people’s life 
and safety, it will be possible as a last resort to ask a court for a temporary suspension of their service, after 
involving all relevant parties. 


More information about the self-regulatory programme can be found on www.edaa.eu . 
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